Privacy Policy

Botanical Blends is a distributor and retailer of third-party botanical brands. This policy explains what personal information we collect when you visit our website, place an order, or apply for a wholesale account, how we use it, who we share it with, and the choices you have.

Effective date: [EFFECTIVE DATE].

This site is operated by [BUSINESS NAME / LEGAL ENTITY] ("Botanical Blends," "we," "us," "our"), located at [STREET ADDRESS], [CITY], [STATE] [ZIP], [COUNTRY]. Our store runs on Shopify, which hosts the site and processes orders on our behalf.

Age restriction and minors

This website and everything sold on it are intended for adults 21 years of age and older. By using the site or placing an order, you represent that you are at least 21.

We do not knowingly collect, use, or store personal information from anyone under 21. We do not knowingly market to anyone under 21, and we do not build audiences or advertising segments intended to reach people under 21.

If we learn that we have collected information from someone under 21, we will delete that information from our active records as soon as reasonably possible and cancel and refund any pending order associated with it, subject to any records we are required to retain by law. If you are a parent or guardian and believe a person under 21 has given us personal information, contact us at help@botanicalblends.com and we will act on it.

Age verification is one of the reasons we collect and process certain information — see "How we use information" below. We may require verification at checkout or at delivery, and we may cancel and refund any order we are unable to verify.

Information we collect

Information you give us

• Order and contact information — your name, email address, phone number, billing address, and shipping address.
• Payment information — card or payment account details you enter at checkout. See "Payment information" below for an important note about how this is handled.
• Account information — if you create an account, your login credentials, saved addresses, and order history.
• Age confirmation — your response to any age gate, checkbox, date of birth field, or third-party age verification step we use.
• Support communications — the content of emails, calls, chats, and form submissions, including any photos of a product, label, lot code, packing slip, or shipping box that you send us to support a claim.
• Marketing preferences — whether you have subscribed to our email or SMS list, and whether you have unsubscribed.
• Reviews and user content — anything you post publicly on the site, including your display name.

Payment information

We do not store full payment card numbers. Payments are processed by Shopify's payment processors and other third-party payment providers, who receive your card or account details directly and handle them under their own security standards and privacy policies. What we typically see and retain is limited information such as the payment method type, the last four digits of a card, the card brand, the billing address, and whether the transaction was approved or declined.

Wholesale application information

If you apply for a wholesale or B2B account, we collect additional business information, which may include your legal business name, DBA, business address, business phone and email, contact person, business type, estimated order volume, resale certificate, sales tax permit or exemption certificate, tax identification number (EIN), and business or trade references.

This is more sensitive than ordinary retail order data — tax identification numbers and resale certificates can be misused if exposed. We collect it only to evaluate your application, verify that you are a legitimate business, apply the correct sales tax treatment, and administer your account. We limit internal access to the staff who need it, we do not use it for advertising, and we retain it for as long as your account is active plus any period required by tax and recordkeeping law.

Information we collect automatically

• Device and browsing data — IP address, browser type and version, operating system, device type, screen size, referring site, language, and time zone.
• Usage data — pages viewed, products viewed, search terms entered on our site, links clicked, time spent, and the path you took through the site.
• Order and cart activity — items added to a cart, abandoned carts, and checkout steps completed.
• Email engagement — whether a marketing email was opened and which links in it were clicked.
• Cookies and similar technologies — see "Cookies and tracking" below.

Information we receive from others

We may receive information about you from Shopify, payment processors, fraud screening services, shipping carriers, age verification providers, marketing and analytics platforms, and apps installed on our store. For example, a carrier tells us a delivery status, and a fraud tool tells us a risk score for an order.

How we use information

• Fulfilling orders — processing payment, packing, labeling, shipping, and sending order and shipping confirmations.
• Customer support — answering questions, tracing packages, handling returns and refunds, and processing damage, defect, or shortage claims.
• Age verification and eligibility — confirming that a purchaser is 21 or older and that we may lawfully ship to the delivery address.
• Fraud prevention and security — screening orders, investigating chargebacks and disputes, protecting accounts, and protecting the site from abuse.
• Wholesale account administration — reviewing applications, verifying resale certificates, setting account pricing and terms, and applying correct tax treatment.
• Marketing, with your consent — sending promotional email or SMS where you have opted in, and, where permitted, showing you advertising on other sites.
• Analytics and improvement — understanding how the site is used, which products and brands people look for, and where the site is failing them.
• Legal and compliance — meeting tax, recordkeeping, and other legal obligations, responding to lawful requests, and enforcing our Terms of Service.

Who we share information with

We share personal information with service providers and partners who need it to run the business. We do not authorize them to use it for their own unrelated purposes. Categories include:

• Shopify — our ecommerce platform, which hosts the site and stores order and customer records.
• Payment processors — to authorize and settle payments, screen for fraud, and process refunds and disputes.
• Shipping carriers and fulfillment partners — to print labels and deliver your order, which requires your name, address, and often your phone or email for delivery notifications.
• Email and SMS marketing platforms — to send the messages you have subscribed to and the transactional messages tied to your order.
• Analytics providers — to measure site traffic and performance.
• Advertising partners — where we run advertising, to measure it and, where permitted, to show relevant ads. See "Cookies and tracking."
• Apps installed on our store — currently a product-review platform (Judge.me), a site-analytics and session-recording tool (Microsoft Clarity), and Shopify Forms for our contact and wholesale enquiries. Each receives only the data it needs to do its job. We update this list when we add or remove an app.
• Third-party brands we resell — only where necessary, and only the minimum needed. For example, if you report a product defect, a labeling question, or a formulation concern, we may pass your order details, photos, lot or batch code, and contact information to the manufacturer so they can investigate and respond.
• Professional advisors — accountants, auditors, insurers, and lawyers, under duties of confidentiality.
• Legal and safety — law enforcement, regulators, or others where we are legally required to, or where we reasonably believe it is necessary to investigate fraud or protect the rights and safety of any person.
• Business transfers — if we are involved in a merger, acquisition, financing, or sale of assets, customer information may be transferred as part of that transaction.

We do not sell your personal information in the ordinary sense

We do not sell customer lists, and we do not hand over your personal information to third parties in exchange for money.

Be aware, though, that "sale" and "share" have unusually broad statutory meanings under several US state privacy laws. In some states, those definitions can cover ordinary practices such as using advertising or analytics cookies, running a retargeting pixel, or letting an advertising partner measure a campaign — even when no money changes hands. To the extent our use of those tools qualifies as a "sale" or as "sharing for cross-context behavioral advertising" under a law that applies to you, you have the right to opt out. See "Your privacy rights" and "Cookies and tracking" below for how.

We do not sell or share the personal information of anyone we know to be under 21, and this site is not intended for them in the first place.

Cookies and tracking

Cookies are small files stored on your device. We and our providers use cookies, pixels, tags, local storage, and similar technologies for:

• Strictly necessary functions — keeping you logged in, remembering your cart, securing checkout, and recording that you passed the age gate. The site does not work without these.
• Preferences — remembering settings such as your region or language.
• Analytics — measuring traffic, performance, and how people move through the site.
• Session recording — we use a session-replay tool that records pages viewed, clicks, scrolling, and mouse movement, and builds aggregate heatmaps, so we can see where the site is confusing or broken. Recording is configured to mask text entered into form fields, so it is not intended to capture what you type. Because browsing a site like ours can reveal an interest in particular products, we treat these recordings as sensitive, keep them for a limited period, and do not use them to build advertising profiles or sell them.
• Advertising — measuring campaigns and, where we run them, showing you relevant ads on other sites.

How to opt out

• Cookie banner or preference link. Where a cookie banner or a "Cookie preferences" or "Do Not Sell or Share My Personal Information" link is shown on our site, use it to set your choices. That is the fastest route.
• Browser settings. Every major browser lets you block or delete cookies. Blocking strictly necessary cookies will break checkout and account login.
• Global Privacy Control. Where required by applicable law, we honor the Global Privacy Control (GPC) browser signal as an opt-out of sale and sharing for the browser that sends it.
• Platform and industry tools. Advertising and analytics providers generally offer their own opt-outs, as do industry programs such as the Digital Advertising Alliance and the Network Advertising Initiative.
• Email us. Send an opt-out request to help@botanicalblends.com.

Opt-out preferences are usually stored in a cookie tied to a single browser and device, so clearing cookies or switching browsers may require you to set them again.

Marketing email and SMS

We send marketing messages only to people who have opted in. You can unsubscribe at any time:

• Email — click the unsubscribe link at the bottom of any marketing email, or email help@botanicalblends.com and ask to be removed.
• SMS — reply STOP to any marketing text. Message and data rates may apply.

Transactional messages continue regardless. Unsubscribing from marketing does not stop order confirmations, shipping and tracking notices, delivery exceptions, refund and return updates, wholesale account notices, security alerts, or messages we are legally required to send. Those are part of the service, not marketing, and cannot be opted out of while you have an active order or account.

Data retention

We keep personal information for as long as we need it for the purpose it was collected, and then for as long as we are required to keep it by law.

• Order and transaction records — retained for tax, accounting, and audit purposes for the period required by applicable law, typically several years.
• Account information — retained while your account is open, and for a reasonable period afterward.
• Wholesale records, including resale and exemption certificates — retained for as long as the account is active plus the period required by tax law.
• Support communications and claim records — retained for a reasonable period after the matter is resolved, in case a claim is reopened.
• Marketing records — retained until you unsubscribe, plus a suppression record kept indefinitely so that we can honor your unsubscribe.
• Age verification and fraud records — retained as needed to show that we met our obligations.

When we no longer need information, we delete it or de-identify it.

Your privacy rights

Depending on where you live, US state privacy laws — including the California Consumer Privacy Act as amended by the CPRA, and the comparable laws that a growing number of other states have enacted — give you some or all of the following rights. Which rights you have, and the exact limits on them, depend on your state's law.

• Right to know or access — ask what personal information we have collected about you, the categories of sources, why we collected it, and the categories of third parties we disclosed it to, and request a copy.
• Right to delete — ask us to delete personal information we collected from you, subject to exceptions such as completing a transaction, meeting a legal obligation, detecting fraud, or maintaining records we are required to keep.
• Right to correct — ask us to fix inaccurate personal information.
• Right to opt out of sale, sharing, and targeted advertising — direct us to stop selling or sharing your personal information and to stop using it for targeted or cross-context behavioral advertising.
• Right to limit the use of sensitive personal information, where your state provides it.
• Right to non-discrimination — we will not deny you products, charge you a different price, or give you a lower level of service because you exercised a privacy right.
• Right to appeal — several states let you appeal if we deny your request. Our denial will tell you how.

How to submit a request

Submit a request at help@botanicalblends.com, or email help@botanicalblends.com with "Privacy Request" in the subject line. Tell us which right you are exercising and give us enough information to find your records — typically the email address and, if applicable, the order number you used.

We will verify your identity before we act on a request to know, delete, or correct, because we are not permitted to disclose or erase personal information on an unverified request. Verification is usually a matter of confirming details we already hold. We will respond within the time your state's law allows, and we will tell you if we need an extension.

Authorized agents. You may use an authorized agent where your state's law permits. We will ask for proof of the agent's authority and may still ask you to verify your identity directly.

International visitors

Botanical Blends is based in the United States, our store is hosted in the United States, and our service providers are located in the United States and other countries. If you access this site or contact us from outside the United States, your personal information will be transferred to, stored in, and processed in the United States and other countries whose data protection laws may differ from those of your own country. By using the site, you understand that this transfer is necessary to provide the service to you.

This policy is written for a United States audience and does not attempt to describe rights under non-US privacy laws. If you believe a non-US privacy law applies to you, contact us at help@botanicalblends.com and we will tell you what we can do.

Security

We use administrative, technical, and physical safeguards to protect personal information. Our store runs on Shopify, checkout is encrypted in transit, payment card details go directly to payment processors rather than to us, and internal access to sensitive information — particularly wholesale tax and certificate data — is limited to staff who need it.

No method of transmission or storage is perfectly secure. We cannot guarantee that personal information will never be accessed, disclosed, altered, or destroyed in a way we did not intend, and we do not promise absolute security. Protect your own account by using a unique password and telling us promptly at help@botanicalblends.com if you believe your account has been compromised.

Third-party sites and links

Our site may link to third-party websites, including the websites of the brands we resell. We do not control those sites and are not responsible for their privacy practices. Read their policies before giving them your information.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the apps and providers we use, or the law. When we do, we will change the effective date at the top of this page. Material changes will be communicated by a notice on the site or by email where required. Continuing to use the site after an update means you accept the updated policy.

Contact us

Questions about this policy, or about the personal information we hold:

• Privacy requests: help@botanicalblends.com
• General enquiries: contact@botanicalblends.com
• Wholesale: wholesale@botanicalblends.com
• Phone: [SUPPORT PHONE]
• Mailing address: [BUSINESS NAME / LEGAL ENTITY], [STREET ADDRESS], [CITY], [STATE] [ZIP], [COUNTRY]

Legal notice

This document is a starting template, not legal advice. It was drafted for a US-based, kratom-free botanical distributor and reseller selling to adults 21 and over, and it has not been reviewed against the specific facts of this business, the apps installed on this store, or the privacy laws of every state we ship to. Have qualified legal counsel review and adapt it before launch, and re-check it whenever we add an app, a data provider, a marketing channel, or a new state.

Last updated: [DATE].